grant/keysat-root
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update licensing-tiers guide: signed-key entitlement ceiling

Browse Source
This commit is contained in:
Keysat
2026-06-19 09:23:07 -05:00
parent 255d669cf0
commit 4ce76f8c75
1 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/guides/licensing-tiers.md
+9 -5
View File
@@ -23,12 +23,16 @@ license lifts those caps and unlocks `recurring_billing` + `zaprite_payments`.
Treat any "marketplace build refuses to start without a license" wording in code
comments or copy as stale.
## Live entitlements
## Live entitlements, clamped to the signed key
Tier gates must read **LIVE** entitlements from `licenses.entitlements` (refreshed
hourly by `refresh_self_tier_from_db` in `license_self.rs`), **not** the
entitlements baked into the signed payload at issue time. The signed payload is a
point-in-time snapshot; entitlements can change after issuance.
Tier gates read **live** entitlements from `licenses.entitlements`, refreshed
hourly by `refresh_self_tier_from_db` in `license_self.rs`, so issuer-applied
**downgrades, suspensions, and revocations** reach a running daemon without a
restart. The signed self-license key is the **ceiling**: the live DB row may
*narrow* the tier but never *widen* it past what the signature grants
(`clamp_to_signed_ceiling`). A genuine **upgrade** therefore comes from a
re-issued key — re-run the StartOS "Activate Keysat license" action — not from
editing the DB row.
## Never silently widen a tier